PT-2026-30972 · Orangehrm · Orangehrm

Rvizx · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39349

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.8

Description OrangeHRM Open Source encrypts sensitive fields using AES in ECB mode. This encryption method preserves plaintext patterns in the ciphertext, potentially allowing disclosure of stored data.

Recommendations Update to version 5.8.1 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2026-39349

Affected Products

Orangehrm

References · 3

• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-g29m-3jgj-gprg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39349 · Security Note
• https://twitter.com/CVEnew/status/2041603159592726710 · Twitter Post